Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,382 downloads1,997 copies115 likes21,640 views
436 detections
Filters
Last updated
All Time
Detection languages
350
73
9
4
Categories
179
86
56
48
42
Platforms
352
35
17
15
11
Products / Services
211
31
23
18
16
MITRE Techniques
149
115
78
48
46
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
Detects registry queries for software inventory and browser settings as well as suspicious scheduled task creation, techniques observed in LummaC2 malware campaigns. Registry queries target installed software and browser preferences for reconnaissance (T1012). Scheduled tasks ensure persistence (T1053.005)
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
Detects the creation of a .plist file in macOS LaunchAgents or LaunchDaemons directories, a technique used by SHAMOS malware for persistence. This rule looks for the specific SHAMOS plist file or for any plist created by a process running from a suspicious location.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
Detects the creation of a new Windows service configured to start automatically from a suspicious file path. This behavior is indicative of persistence mechanisms used by malware like the Tinky Winkey keylogger.
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Detects the creation of keylogger output files by the WinMainSvc component, which is associated with the Crypto24 ransomware group. The keylogger runs as a service via svchost.exe and creates log files in the C:\Windows\tmp\ directory with a specific naming pattern.
Detects possible Lumma infections based on non-browser network connections to TLDs or steamcommunity API as often seen in Lumma infections
Page 42 of 44